13 comments

[ 1.7 ms ] story [ 48.5 ms ] thread
We need supply chain protections for the regular consumer now.
This is the first time I've read an AI-heavy piece and stayed engaged with it all the way through. I think the author's sharing the prompts was key to that experience.
Author here. I didn't realize folks had found this, LOL. As some have noted, yes, large chunks of this article were AI-written. Whether or not it's truly justifiable, I was busy enough that I saw it as the best way to complete the capstone writing on my experience. Again, I'm mildly surprised folks came across it!
In case you are interested in hearing a reader's opinion: the AI writing was noticeable and detracting. The most significant cues for me were the sensational tone and the prolific "clever" one-liners. I think that while it is difficult to make the judgment with any degree of accuracy based on a single suspicious sentence, but given the length of the article, all the individual cues eventually add up to a near certainty.

I think that the sorry thing about the article is that, even though I've read through an article of yours, I have learned nothing about what kind of person you are. I think that there's more to blogging than just showing the work. It's also a stage for you. The displays of character in the article ("I had a feeling", "I sat with that for a minute") written in first person are not actually yours, and are instead, in a way, a performance of the LLM that you used. So in my opinion (and you're free to disagree) you've robbed yourself of the attention you deserved.

However, I assume that the contents of the investigation were true, and if so, they are quite damning (in fact, my SO has just surprised me with a cheap Chinese projector. Nice timing!). It was also great that you've shared the prompts and results at each stage.

I’m immediately suspicious of cheap chinese crap like this.

$35 for a projector should cause you to raise at least one eyebrow.

Also, as always with “IoT” type devices, they’re best kept in an isolated VLAN with no internet access.

Like many people, I've always been vaguely suspicious of IoT devices like these. But I've never seen reverse engineered what it is they actually do. The conclusion goes way beyond my expectations and is rather chilling:

>My $35 projector wasn't just spying on me. It was selling my network. Anyone who paid Kookeey for proxy access could route their traffic through my IP

This would typically not be referred to as a "remote access trojan". It's just an updater, or perhaps a dropper if you want to make it sound more scary.
Is there any instructions on how I can do a similar analysis my own devices?
How more detailed should it be? I mean you get literally every command and what tools were used.
The us gov should pay for this sort of research to be published... bonus points for binaries.
What I missed in analysis is that service sold isn't "selling your bandwidth to a highest bidder" - it's an universal binary delivery system, so if someone would pay more for eg. binary that explores your network and installs btc miner or password stealer on all unsecured devices, then that's what you'll get.